Numerous cryptographic algorithms make use of large-integer multiplication (or exponentiation) and reduction of the product to a residue value that is congruent for a specified modulus that is related to the cryptographic key. Such computations may be susceptible to power analysis and timing attacks. Therefore, it is important that computations be secured so that information about the key cannot be obtained.
At the same time, it is important that these computations be fast and accurate. The large integer multiplication and reduction is usually the most computationally intensive portion of a cryptographic algorithm. Several distinct computational techniques have been developed for efficient modular reduction, including those known as the Quisquater method, the Barrett method and the Montgomery method, along with modifications involving precomputation and table look-up. These well-known techniques are described and compared in the prior art. See, for example: (1) A. Bosselaers et al., “Comparison of three modular reduction functions”, Advances in Cryptology/Crypto '93, LNCS 773, Springer-Verlag, 1994, pp. 175-186. (2) Jean François Dhem, “Design of an efficient public-key cryptographic library for RISC-based smart cards”, doctoral dissertation, Université catholique de Louvain, Louvain-la-Neuve, Belgium, May 1998. (3) C. H. Lim et al., “Fast Modular Reduction With Precomputation”, preprint, 1999 (available from CiteSeer Scientific Literature Digital Library, citeseer.nj.nec.com/109504.html). (4) Hollmann et al., “Method and Device for Executing a Decrypting Mechanism through Calculating a Standardized Modular Exponentiation for Thwarting Timing Attacks”, U.S. Pat. No. 6,366,673 B1, Apr. 2, 2002 (based on application filed Sep. 15, 1998).
An objective of the present invention is to provide an improvement of the Barrett modular reduction method and computing apparatus therefor, which is more secure against cryptoanalysis attacks, while still providing fast and accurate results.
Another objective of the present invention is to provide the aforementioned improved method and apparatus which speeds up quotient estimation.